Splunk Inc. (NASDAQ:SPLK) Q4 2021 Earnings Conference Call March 3, 2021 4:30 PM ET
Ken Tinsley - Head of Investor Relations
Douglas Merritt - President and Chief Executive Officer
Jason Child - Senior Vice President and Chief Financial Officer
Conference Call Participants
Kasthuri Rangan - Goldman Sachs Group, Inc.
Brad Zelnick - Credit Suisse AG
Raimo Lenschow - Barclays Bank PLC
Philip Winslow - Wells Fargo Securities, LLC
Matthew Hedberg - RBC Capital Markets
Brent Thill - Jefferies LLC
Sanjit Singh - Morgan Stanley
Keith Bachman - BMO Capital Markets
Michael Turits - KeyBanc Capital Markets Inc.
Stewart Materne - Evercore ISI
Ladies and gentlemen, thank you for standing by, and welcome to the Splunk Inc. Fourth Quarter 2021 Financial Results Conference Call. At this time, all participant lines are in a listen-only mode. After the speakers’ presentation, there will be a question-and-answer session. [Operator Instructions] Please be advised that today's conference is being recorded. [Operator Instructions]
I would now like to hand the conference over to your speaker today, Ken Tinsley. Thank you. Please go ahead, sir.
Great. Thank you, and good afternoon. With me on the call today are Doug Merritt and Jason Child. After market closed today, we issued a press release, which is posted on our website. Also, note that we have posted supplemental material on the Investor Relations web page as well. This conference call is being broadcast live via webcast. And following the call, an audio replay will be available on our website.
On today's call, we will be making forward-looking statements, including financial guidance and expectations such as our forecast for our first quarter as well as future expectations of revenue mix, renewals, duration and cloud growth and cloud gross margin, as well as trends in our markets and our business and expectations regarding our acquisitions, products, technology, strategy, customers, demand and markets.
These statements are based on our assumptions as to the macroeconomic environment in which we will be operating and reflect our best judgment based on factors currently known to us, and actual events or results may differ materially. Many of these assumptions relate to matters that are beyond our control and changing rapidly, including the impact of the COVID-19 pandemic on our business and that of our customer and the overall economic environment. Related to this uncertainty, certain customers have and may in the future continue to decrease or delay spending commitments particularly for certain high dollar and long-term contracts.
Please refer to documents we file with the SEC, including the Form 8-K filed with today's press release. Those documents contain risks and other factors which may cause our actual results to differ from those contained in our forward-looking statements. These forward-looking statements are being made as of today, and we disclaim any obligation to update or revise these statements. If this call is reviewed after today, the information presented during this call may not contain current or accurate information. We will also discuss non-GAAP financial measures, which are not prepared in accordance with generally accepted accounting principles. A reconciliation of GAAP and non-GAAP results is provided in the press release and on our website.
With that, let me turn it over to Doug.
Thank you, Ken, and thanks to everyone on the call for joining us. Q4 was a strong finish to a memorable year for Splunk. I am proud of both our results as well as the dedication and tenacity of our team over these past 12 months and particularly during our year-end. And I am so very grateful to the trust and commitment of our customers and partners.
Splunk ended the year with overall annual recurring revenue of $2.36 billion, up 41% over last year. Even more importantly, we saw continued impressive results in our cloud-first initiative, with cloud ARR delivery of $810 million, up 83% over last year, and accelerating from our growth rate in Q3. Driving our continued transition in the cloud has been our number one company priority for the past three years, and that’s continuing into FY 2022. We remain very pleased with the progress of our transition to cloud.
Looking back in time just four years ago, cloud was less than 20% of our software bookings, delivering $48 million in revenue, and the upper end of allowable daily data volume was about 10 terabytes per day. Today, cloud revenue stands at $554 million, representing an 84% CAGR. We are deploying a 100 terabytes-plus footprints with customers taking advantage of workload versus data ingest pricing and cloud now represents the majority of our business, with 51% of our software bookings coming from cloud in Q4.
We’ve seen that when our customers move to cloud, the investment they make in Splunk expands rapidly as they utilize the high velocity of our cloud innovations, features and machine learning, ultimately allowing them to free up resourcing and reorient their focus and time to what’s most critical to them.
Despite the continued uncertainty and volatility of the macro environment, we had a strong finish to the year. In Q4, we saw procurement patterns that were closer to what we experienced in Q1 and Q2. And we were also able to close transactions with several of the accounts that deals slipped in Q3. Throughout the 100-plus customer interactions I’ve had over the past several months, I am hearing about their continued belief in the value of our technology and I’m seeing many of them expand their commitments to Splunk as a result.
Over the past year, the world has experienced more change than the past 10 years, and there are signs that 2021 will be similar, especially when it comes to data and to technology. Already, we are seeing companies with a strong digital strategy outpacing their peers. The organizations have prioritized the strategic use and operationalization of all of their data will achieve significant business and economic benefits.
We are also seeing cybersecurity attacks at unprecedented levels and scale. The magnitude of SolarWinds hack has hammered home the unsettling, but ever-present reality of the digital era that all organizations are likely to get hacked at some point.
Digital security has become a broad governance comparative. Splunk is working side-by-side with our customers to help them drive the change, resiliency and optimization around both of these key and critical trends. As an example, at the onset of the SolarWinds hack, Splunk took immediate action to both enable customers to investigate whether they had been impacted by the attack and to confirm the Splunk itself had not been impacted.
Our customers count on us to deliver timely detection capabilities. We did not disappoint. Our security strategy team published materials to guide our customers on how to use our products to find evidence of the Sunburst Backdoor. Our professional services and customer success teams deployed remote on-demand services to help customers implement this guidance. From there, our product and security teams released timely Splunk research and dynamic security content, using the update capability in Splunk Enterprise Security to help our customers understand their own risk.
As a whole, we responded rapidly to deliver the best-in-class value that our customers and community expect from Splunk. We know that all organizations are on a journey to bring Data-to-Everything and our mission to remove the barriers between data and action so everyone thrives in the data age, has never been more important. The breadth and depth of our Data-to-Everything Platform dramatically enhances the richness and value of our focused solutions for our customers across IT operations, security and DevOps.
Observability was among the standouts within our business in FY 2021, fueled by customers accelerating their own digital transformations and shifting to modern application development. Our customers are clearly excited about our observability capabilities and the market is too. Just last week, industry analyst firm GigaOM, published the industry’s first-ever evaluation of the cloud observability market, naming Splunk as the only outperformer, and knowing that Splunk has emerged as one of the leaders in the observability space.
Here just a few examples in this past quarter, where Splunk enables some of the largest and most innovative organizations in the world to do more and bring more of their teams together on a common data platform.
British grocery retailer, Tesco, is a long-time Splunk customer and the third largest retailer in the world in terms of gross revenue. Tesco recently expanded their use of Splunk Enterprise Security and our Observability Suite to better support an 80% increase in online sales, brought on by COVID-19 in the run-up to Christmas. By leveraging Splunk to take action on their data, Tesco can provide their customers with a seamless online shopping experience and improved delivery speed.
Nationwide Building Society, the largest building society in the world, expanded their use of Splunk Cloud and Enterprise Security to ensure their 15 million members received the fastest response on protection against fraudulent activity. Relying on Splunk is an integral part of their cloud transformation, the British mutual financial institution has already seen a significant cost reduction across all services and will be better equipped to safeguard their customers, their financial accounts and their personal data.
Leading omnichannel commerce platform, Shopify, continues to expand their use of Splunk Enterprise as well as Splunk Application Performance Management or APM, as the company transforms their observability strategy. With the increase in e-commerce and online purchases brought on by COVID-19, Shopify expanded with Splunk to address their growing tracing and application monitoring demands, as well as provide them with visibility across our entire organization. With our observability solutions, Shopify is able to scale and support over 1 million merchants selling their products online.
Long-time customer, Okta, upgraded their use of Splunk Cloud, which serves as their Data-to-Everything Platform across the entire business. With Splunk Cloud, Okta can better serve their 9,400-plus customers by monitoring and providing faster response times and fewer error rates. Okta also leverages Splunk to better understand customer usage patterns, enabling them to continue to enhance our customer experience capabilities. These customer wins in Q4 underline the importance data plays as organizations scale their online and virtual environments.
In summary, we delivered a strong finish to our year as we continue to deliver for our customers and execute across our multi-pronged transition. Once again, the majority of our software bookings came from the cloud, driven by cloud ARR growing at 83% year-over-year. With an overall $2.36 billion business growing at 41%, we are delivering best-in-class growth at scale, which is just one of the many reasons Splunk was just included among Fortune’s Most Admired Companies for the first time ever.
We are excited about the year ahead and the opportunity to serve our customers with our incredibly rich technology portfolio, our industry-leading customer success and support offerings, and our cloud-first footing.
I’ll now hand over to Jason for more on the quarter and fiscal year results. Jason?
Thanks, Doug, and good afternoon, everyone. Thanks for joining us. Q4 was a strong finish to a volatile year. We ended fiscal 2021 with total ARR of $2.36 billion, up 41% year-over-year, cloud ARR of $810 million, up 83% over last year, and 510 customers with ARR greater than $1 million, up 44%.
On our last call, I described the slowdown in the close rates for several of our largest orders in the final weeks of Q3, which we attributed to persistent uncertainty stemming from COVID and other macro factors. We said all indicators pointed to strong demand overall, but some customers were taking a pause to reevaluate the timing of high value spending commitments. We were confident in the eventual closing of many delayed transactions, but specific timing was uncertain.
Today, I am pleased to report that not only did we close transactions with several of the accounts that had deals slipped from Q3, but we did not see a repeat of slower close rates in Q4 to the degree that we saw in Q3.
Now on to results. We ended the period with total RPO of nearly $2 billion, up 10% over Q4 of last year and the portion of RPO, which we expect to recognize as revenue over the next 12 months was just over $1.2 billion, up 23% from last year. It’s important to note that both current and total RPO growth rates were muted last year as we didn’t yet have the benefit of renewal bookings from a substantial pool of previously booked multiyear contracts.
As we highlighted at Analyst Day, we expect that the renewal of a sizable base of prep to term conversions that we initially booked two to three years ago will begin to contribute meaningfully to overall bookings this year, FY2022. These renewals should drive bookings growth and the convergence of RPO growth and ARR growth rates over the next 12 to 18 months.
On the P&L. Total revenues were $745 million in Q4 and $2.23 billion for the full-year, both down slightly from last year reflecting substantially higher cloud mix, as well as a sharp decline in average duration for term contracts. We expect the average contract duration will start to normalize in Q1 as we lap the first anniversary of the pandemic.
Q4 cloud revenue was $171 million, up 72% over last year, and full-year was $554 million, up 77%, both reflecting continued acceleration of customer adoption of our cloud platform.
On margins, which are all non-GAAP. Cloud gross margin was 62% in Q4 compared to 54% last year with continued progress towards our long-term target of at least 75%. Total gross margin in Q4 was 83% down on a year-over-year basis due to the greater proportion of revenue contribution coming from cloud.
Operating margin was 13% in Q4, substantially higher than planned due to our significant topline outperformance, and full-year op margin was negative 4%. Again, operating margin is impacted by lower revenue from shorter average term contract duration and growing cloud mix.
Finally, operating cash flow was negative $191 million for the year, about $100 million better than last year, and in line with our expectation following our shift to annual invoicing in fiscal 2020.
Turning to guidance. While the demand environment is strong, given the continuing market uncertainty, we remain cautious on specific growth expectations until there are clear signs of market recovery and stabilization. Until then, we will be keeping our guidance horizon short. As such, we expect to end the Q1 with total ARR of between $2.42 billion and $2.44 billion.
On the income statement, the cloud transition continues to drive variability in our revenue and operating margin results. We expect total revenues of between $480 million and $500 million depending on cloud mix, and with the non-GAAP operating margin of approximately minus 30% reflecting our normal seasonal pattern.
In closing, Q4 was a strong finish to a very unusual year. We outperformed our targets in the first half during the onset of the pandemic, saw lower-than-usual large deal close rates in the final weeks of Q3 and then closed the year with strong execution in Q4. When we look back on the year as a whole, we are very pleased with the progress of our transition and the strength of our cloud business in particular. It’s become clear that the headwinds we are facing are predominantly from the term business as customers have been cautious to make long-term commitments, especially during the pandemic.
On-prem customers are also being more measured in the size and length of their term contracts as they contemplate their plans for a substantial cloud expansion with Splunk. While the term business will likely remain volatile, we expect our cloud business will continue to ramp quickly.
The overall demand environment remains strong and cloud continues to outperform our expectations as you can see in the very high ARR and revenue growth rates. We are planning for continued cloud strength in our business and look forward to keeping you updated on our progress on future calls.
With that, let’s open it up for questions.
[Operator Instructions] Our first question comes from the line of Kash Rangan from Goldman Sachs. Your line is now open.
Thank you very much and congratulations to the Splunk team on putting up a really good show in this Q4. One question for Jason and one for Doug. One for Jason. As you look at the cloud numbers, I mean, certainly, you're seeing cloud ARR accelerate at scale, which is truly significant.
As you play this out, there is a transition that the company went from license to subscription, then going from subscription to cloud. As you play this out, is it not conceivable that in a two-year time horizon or so, if cloud becomes a majority of the revenue, you do actually become a cloud company. And what are the implications of that for the Splunk business model?
And one for you, Doug, if you can, given that there's a lot of crosscurrents, you've had a change in leadership with the departure of worldwide Head of Field Operations and also increasing noise about the competitive environment. And it looks like the execution has certainly improved.
What is your – as you sit today and do this call with us, what is your outlook for Splunk given the perception of greater competition, the hires you might or might not be making to the executive team and how your business pans out and your confidence overall? Although you don't have a target for us three years out, how do you think about the three-year outlook for Splunk, given all the crosscurrents that are being discussed? Thank you so much once again and congratulations.
Thank you very much, Kash. I'll start and then Jason follow-up with the cloud piece, which I think is very prescient of you, Kash. I agree. So from a Splunk competitive position, I am really excited about where we are right at this point in time. I feel like we are in a better position than we've ever been. The continued expansion of our Data-to-Everything capabilities, feathering and stream processing and having that become a much material portion of the Data-to-Everything Platform, continued enhancements and machine learning, streaming and non-based collaboration services, orchestration services, I think sets us up to be in a good position as the industry continues to pivot.
And just as importantly or more importantly, the continued enhancements of our solutions and suites that focus on security, ITOps and observability, I think, are a very, very well positioned with strong technical buyers and a lot of repurposing and cross-fertilization between the data and the use cases across those three buyers that marketplace will continue to get more competitive, no doubt.
I think that we were early in all areas. Security is probably the prime example of calling it a data problem, not a transaction problem or – and I think as people have woken up, continue to wake up to the importance of data and the importance of the buyers that we're going after, we absolutely should all expect more people to participate. And we estimate that’s $85 billion to $90 billion worth of total addressable market just across our key target areas.
We were very proud of our $2.365 billion in ARR as a company and $810 million of ARR as a cloud provider. But as – we can always do the simple math, that's a small percentage of that TAM. So a lot of people chasing it as they should be, and I will continue, and my team will continue to look for any and every awesome talent that we can bring into the company. While we're excited about the progress we've made over the past five years, we are shooting for the $5 billion, $10 billion, $20 billion mark. There's a big TAM and a lot we have to do.
So whether it's the development and sales and marketing teams continue to bring in really, really best-in-class folks, I'm so impressed at the people that we're adding to the team or any continued shifts that we'll be making to augment and strengthen our executive ranks. That's what we have to do to be able to be as competitive as we need to be to capture the majority of lion's share of these very key and crucial markets.
Jason, do you want to chime in on the cloud business and its impact overall?
Yes. So on the cloud business, yes. So as you pointed out, we've seen really strong ARR growth throughout the year. And so clearly, over time, we will get to a point where I think you saw last year for the first time on the software bookings basis, 50% is cloud. We've said in the past, we expect that number to continue to grow. We forecast that it could be 70% to 80% over sometime in the next few years. And so you should expect to see that the revenue related to the cloud business should be over half of the revenue, probably not likely this year, most likely next year. That said, I mean, you can kind of model, you can see how the cloud business has been pretty steady in the 70% to 80% range now for going back, I think, the last eight quarters.
If you look at the term business, that's kind of where – if you kind of step back, that's where some of the volatility has been. And I think this last quarter you can do the math and basically see that the term business grew at about 26% – the ARR grew 26% year-on-year. That's moving around a little bit partly due to customers trying to assess either impacts from the pandemic as well as trying to figure out how much capacity they want to buy before they make their transition to cloud.
And so even though that number is volatile, it's really not kind of an indication on the health of the business. It's more about an indication of what customers want to preserve flexibility, so they can continue to make their own plans to move towards cloud, which is what the vast majority of customers have indicated.
Thanks. Truly exciting. Congratulations.
Thank you. Our next question comes from the line of Brad Zelnick from Credit Suisse. Your line is now open.
Excellent. Thank you so much, and I'll echo Kash’s congrats. Great quarter. And it's nice to see a return to the kind of performance we expect from Splunk in Q4, excuse me, especially in cloud. So I don't want to dwell too much on the past, guys. But just as we think about Q4 and the selling environment and what you're seeing out there, I’d just be curious to get a sense from you guys. How you would characterize the appetite for large deals and how things are unfolding? It's obviously happening very quickly.
And then specific follow-up to what Kash had asked. I have picked up some recent changes in the North America sales leadership beyond Susan's departure. Just wanted to check in on how you're thinking about the stability and productivity of the field organization specifically in North America?
Thank you, Brad. It's Doug. I'll start off. So the macro environment that I think I've consistently talked about all quarters, even after, I think, a very impressive Q1 appears to be pretty consistent, which is with so much volatility in the – both with the pandemic and the stock market and the potential impacts in the economy. And the number one thing that we have seen is a lot more scrutiny on high dollar-value transactions.
And all of my CEO circles and one on ones with other CEOs, whether they're specifically talking about it on earnings calls and other venues or not, it's something that that we're all seeing. We saw the same thing in Q4. I think what we have been focused on over the course of this year is staying very focused on the environmental factors that we can control, not the macro factors that we can't.
And I talked a bit about what we were doing to be prepared for potentially similar behavior in Q4 to help mitigate the risks in Q4 and have us come in within our range or in this case, over our range for the quarter. We'll see what happens in Q1 and Q2. If we can keep get back progress on vaccines and opening it up to the states and the stimulus passes, and then hopefully we'll see some of that scrutiny come down. But I'm proud of the teams and excited about the work we've been doing because I think it really has helped us up our operational game pretty dramatically across the different theaters and the way that we triply locked down on validating budget and trying to flush out unforeseen blockers outside the economic buyer even when budgets are fully approved and the economic buyer think they've got free rein.
In North America, we were very excited to promote one of our superstars to lead North America, the Americas I should say. And eager to see how he continues to grow into that role. As you guys all can imagine when you're growing the business overall and ARR rates in excess of 40%, cloud growth rates in the high 70s, 80%, a number that was the number three years ago becomes a very different number going into this year and next year. So it's our job to continuously groom and make sure that people have got the right skills to be able to scale and continue to bring in additional talent to work side-by-side or over around different folks so that we can keep fulfilling the opportunity of TAM that's in front of us. And there's always change and we're just trying to stay as in front of this as we possibly can.
I think we've got a very compelling opportunity for our reps this year. I think we continue to try and do a better job as we move to ACV and incremental ACV to make the numbers clear and continue to build confidence that they're achievable and over achievable. And my expectations for our Salesforce this year is that those that put their head down and work are going to have really, really good years with the targets that we've rolled out and the portfolio that we have for them to sell.
Awesome, Doug. Thank you so much and congrats again. Stay well, everybody.
Thank you, Brad.
Thanks, Brad. Appreciate that.
Thank you. Our next question comes from the line of Raimo Lenschow from Barclays. Your line is now open.
Thanks. Two questions, if I may. First, let me stay on the cloud side. Doug, you obviously been on the journey there. And I remember about this time last year, you said like only like a minority of sales guys has actually started selling cloud. Like talk a little bit about the evolution there in terms of Salesforce adoption. You mentioned a little bit some of the incentives you have in place to get us a feeling of where we are on that journey, how much we have – how far we have progressed so far?
And then the second question I had was SolarWinds, obviously, you kind of created a lot of noise and a lot of discussions around security. We picked up on our checks, there’s a lot of focus on SIM. You guys, obviously the leaders. How much did that help this quarter? How much did that kind of reengage discussions around that subject? Thank you.
Thank you, Raimo. So cloud absolutely is the highlight. It has been the number one highlight for the company. It's been the number one company priority for three years now, and we're maintaining it as our number one key and top initiative this year as well. And again, in the published data, you can go back to FY2018 and see the very, very consistent and high growth cadence on a revenue basis from $93 million in revenue in FY2018 and cloud at $554 million quickly this year. Similar on the ARR basis, you go back to FY2018, $128 million in ARR in FY2018 at 103% growth rate closing out this year at $810 million with an 83% growth rate.
So that performance is I think, very admirable. If you go and look at the other pure play cloud companies out there, Datadog, New Relic, Sumo, Salesforce, Workday, ServiceNow, CrowdStrike, you'll see that our ARR and revenue performance to be well above, really all those players right now, significantly above some of them. So we're excited about cloud. We are seeing more and more reps transact cloud, and that would be part of the 51% of software bookings being attributed to cloud this year – this past year ending Q4.
We expect that to increase in FY2022. Only real gate right now for reps is, are they serving a customer or a segment of the world where cloud is either not something that the customer or that portion of world is excited about or our offering is still not where it needs to be on a compliance or regulatory basis as we work hard to make sure that we are highly applicable in every major region of the world and able to meet the customer's needs.
Yes. Okay. And then SolarWinds?
SolarWinds. Yes. I think we've probably got a bit of a boost on SolarWinds. When you look at it – and it's more about the hack and the need to really understand what happened in the landscape. And that's where a data platform like Splunk comes in. We have a different operating SolarWinds. So I don't think that we've got a huge opportunity to do full rip and replace in SolarWinds. And I'm not even sure if that's a wise move for many organizations out there, but we do provide a whole different level of scrutiny and capability on monitoring, on detection, on alerting, on reaction, on remediation and ingest a lot of the data that makes other products out there more effective and more capable.
This year you will see a lot of energy around security, and we obviously been very focused on security and think it's a really, really important use case. It's not abating anytime soon. We've got a bunch of releases that we're really excited about this year that continue to keep us, I think, in a pole position in the security landscape. And as much as we've been jumping up and down about observability, which we're still incredibly excited about, and we can talk about it in another Q – the next Q&A or the next person's Q&A, I think security is going to continue to be a stand-up performer for us this year too.
Perfect. Very clear. Congrats.
Thank you, Raimo.
Thank you. Our next question comes from the line of Phil Winslow from Wells Fargo. Your line is now open.
Hi guys. Thanks for taking my question and congrats on the stronger-than-expected close to the quarter. I really wanted to focus in on the pricing commentary that you made. Doug, I think you highlighted your workload-based pricing is impacting the quarter. I guess a couple of sort of sub-questions to this. First, how is sort of customer awareness of the newer pricing models, workload, predictive pricing? Second, how is this changing customer conversation now? And then also from a Salesforce perspective, how sort of ready and ramp is the Salesforce in communicating these pricing models and comparing them?
Great question, Phil, and great to hear from you. The awareness on pricing is definitely continues to be one of the top areas of our focus through this year. As we all know, pricing changes are hard. I think one of the notes out said, that we made a lot of transformations with Splunk, including pricing. This is a really important one. A couple of metrics that we saw this year that excited me, that shows that we're getting the traction that we're hoping. A third of the overall FY2021 cloud ACV was workload pricing-based and almost half of the Americas cloud ACV, which obviously is our more deeply penetrated – most deeply penetrated theory with workload-based pricing. So it is getting traction.
Do we need to do an even better job of marketing it and driving awareness? Yes. Do we need to educate? I think the reps are actually pretty darn educated at this point in time. There is a strong additional education track at our SKO, but we need to keep doubling down that so they understand it – fully understand it, yes. Do we need to get even more aggressive with the partners? Do they understand it? Yes. But I'm hopeful that over the course of this year especially because it is the default motion within cloud that we will see that third of cloud would be workload pricing go up by a pretty dramatic basis, and the impact on almost half of America cloud ACV see that spread to EMEA and APAC as well.
Got it. And then just one more Salesforce follow-up. If you think about observability, which is obviously something you highlighted in Q4 is an area of strength. How ready do you think the Salesforce is to make not only call it the ITOps pitch and the security pitch, but actually the broader security pitch – sorry, sorry the broader observability pitch as well.
Really, really good question, Phil. Great growth here for observability by the way. Triple-digit growth in durability and really proud of the team there. I'm also really excited about the continued integrations, enhancements, ease of use, and the not inorganic work that we're doing within observability. For all of you on the call, I did mention the GigaOM report that just came out. We are the only outperformer in that entire report and we're the most functioning complete offering across all the observability of vendors. So I think we've got a really good hand there. Making sure that every account understands we have there on a marketing basis, and then we've got the right sales support is key this year.
I think their go-to-market piece is the key linchpin. I feel good about the product offerings. We are not just maintaining our observability salesforce, but we're beefing up our observably salesforce and we're actually mirroring or complementing the observability dedicated sellers with security and ITOps dedicated sellers as well. That was a successful enough model with us last year, that when Christian was tailoring the landscape this year. The highest hiring orientation is to compliment the generalist account managers with a growing body of hunter Type A classic sales reps, not so much specialists overlay, but dedicated sales reps and security ITOps and observability. So we expect and are counting on observability having as good or better over year this year as it did last year.
Great. Congrats again guys.
Thank you. Our next question comes from the line of Matt Hedberg from RBC Capital Markets. Your line is now open.
Hey. Great. Thanks for taking my questions. I'll offer my congrats as well. Doug, you've always been strong at expansion. And I think with the expanded portfolio, it's a really intriguing option for you guys to continue to drive more wallet share. I didn't notice a customer count. I know you said you had strong close rates. I'm just sort of curious if you could talk about that motion of new customers now that cloud is 51% of bookings, a majority. Do you get a sense that maybe that land piece of the equation could start to accelerate in fiscal 2022?
Great, great question. And yes, I've said for a couple of years now that we've been consistent with our new customer count, it's staying 2,000-ish new customers per year, which is great, but not expanding at an expanding rate like we'd like to see. Two interesting trends this year. One, a third of the cloud customers are net new. So we're seeing – that happening the way we had thought, which is if it's easier to find, try and buy, which I think cloud is really the driver for, that should expand the net new rate for us.
And then two, Q4 was the first big uptick in net new logos in, I don’t know, probably seven or eight quarters. So we have two trends that at least are early indicators that as we continue to focus on cloud breadth and depth, and I think most importantly in FY2022 ease of use on all aspects, including online purchasing that we'll see that number finally start to get the uptick that we've been targeting and talking about for too many years now.
Yes. That's really good to hear. I mean, I think that's what kind of we all would suspect. So it's good to hear those nuggets were good. And I guess maybe as a follow-up to that, it looks like you guys are hiring at a rapid pace. And with new sales leadership, how do you approach this? Obviously, you're not giving us full-year guidance, but when you think about new reps vis-a-vis your kind of Q1 ARR growth, how are you thinking about that balance between new reps and productivity gains? Because it seems like there's a real opportunity to kind of accelerate some of this new business momentum that you discussed and talking about.
Yes, I agree. And yes, you can see a ton of openings in our website, and it is crazy. I'm sure we're not alone with other high-growth companies to really think through how many people have been hired over the past 12 months that have never been inside of a Splunk office and physically met other Splunkers. So cannot wait for that to start to happen and get the benefits of the physical culture that we're so famous for.
We are keeping the foot on the gas for hiring across the board this year, including in the field. I think a very positive element for our field reps is a big chunk of the hiring is complementary to the generalist account manager. We continue to ramp our renewal sales team, which is a benefit to the existing account manager. And as I talked about earlier with Phil, we are focusing on complementing the generalist with IT, security and observability sales specialists. So we're targeting, I think, a reasonable productivity number for reps. But that productivity is coming because they're getting more resources and more tools to help them within accounts.
And then if you add in the net new attraction with cloud, especially as workload pricing for the platform and device pricing for the solutions, which I think simplify that dramatically, continue to kick in this year. As I said earlier, I think it should be a really stellar year for our sales teams, building even stronger for the sales reps in FY2023.
Thanks a lot. Congrats guys.
Thank you. Our next question comes from the line of Brent Thill from Jefferies. Your line is now open.
Thanks. Doug, just going back to the deals that slipped in Q3 into Q4. We've got numerous questions about – are most of those now cleaned up? Did you get the majority of the larger ones through the finish line? Or are there still a few lingering transactions? And I have a quick follow-up.
Yes. As we said in prepared remarks, we were happy to see the transactions that came through with the accounts that had the extra scrutiny that we talked about in Q3. And again, just a reminder, that top 10 customer realm we talked about was just emblematic. It was just a data point. There's some increased scrutiny out there, and let me just give one data point that we're working with.
We had some really nice traction through Q4 as well with being – trying to stay a step ahead or aware of or work with the known macro reality that big ticket deals are going to have additional scrutiny. So really impressed and proud with the resiliency and thoroughness of our sales teams to do everything they can to kind of flush out that unforeseen stoppage that we were experiencing throughout the year. And again, as I said earlier, I feel like it – what doesn't kill you makes you stronger. I think that the teams really came through this year with a nice bonding and a whole degree of appreciation and rigor that I am hopeful will carry through FY2022 as I'm sure we'll be dealing with all kinds of new surprises this year and hopefully, most of them positive, but still new changes in the environment.
Okay. And just back to your comment, Doug, a compelling opportunity for your sales reps this year. As you go into the new year, what overall changes have you made on the go-to-market? Anything that you would highlight that is going to be a major catalyst and you think helpful this year that you would call out?
I think that – so when I look at the top three company initiatives over the past couple of years, they've been very consistent. Get to cloud and cloud-first is one. Continue to double down and penetrate the three core buying centers, security, ITOps and DevOps/observability is number two. And then continue to expand the underlying Data-to-Everything platform to serve those use cases, number three. And I think all three of those really work in concert to help our reps. And the one that we're really, really focused on this year, and they're all three equally important, those were in priority order, was a continued focus on the three core buying centers.
So from a go-to-market assistance, from a marketing campaign orientation, from ROI, tooling, feedback on usage patterns, we're getting – continue to get more effective and refined in understanding the traction within those three core buying centers. And we're continuing, as you've seen, to add more features and function and capability to the underlying platform, for sure, but to the overall security offering, to ITOps offerings and observability offerings.
So lots of good expansion within their buying center, with the additional buying center-based reps, I think more effective cross-buying center selling. And then as we really do an effective job of cornering those three key user communities, that's when we start to see the company standardize on Splunk as a data platform. And those fund use cases that we talked about with Porsche and Domino's and BMW and Tesco and when they start to use this beyond, the technical buying centers kick in as they're focused on revenue generation and cost savings activities.
Thank you. Our next question comes from the line of Keith Weiss from Morgan Stanley. Your line is now open.
Hi. This is Sanjit Singh in for Keith, and congrats on the really great Q4. Doug, I'm loving all these data points and nuggets that you're dropping through this Q&A. I could use more of that. For my two questions, though, I want to start with Jason. On the acceleration in net new cloud growth in terms of that getting back to 80% plus growth. By your comments, it didn't sound like migrations was the key factor here. It sounds like net new customers and existing customers expanding. If and when that migration motion starts to happen, should we expect an uplift on that term base over time? What's sort of the right way to frame what is already a great organic cloud growth story?
This is Jason. So I would say – I would think of it as being still early days. While it's 50% – 51% of software bookings in the quarter, if you look at the ARR, it's closer to a third. And so I think you should expect that there is over – well, there's a – majority of our customer base still has not gone through that transition. And so I would expect there to be pretty significant kind of tailwinds.
In terms of whether the growth accelerates or whatnot, that of course, is dependent upon the timing and a bunch of factors. But with the trends that we've provided on the website slides, you can see it's been pretty consistent and pretty strong for a while. I think the other thing I would call out is the dollar-based net retention, which is the cloud-based number, that still remains at our size, very, very high, 129% on a trailing four-quarter basis, which includes the slowdown that we saw in Q3 is still very, very kind of like best-in-class terms for an $810 million ARR business.
So I would expect that there are multiple points of kind of tailwinds across customers, across expansion history and future opportunities. And then also, Doug had mentioned observability, which is all cloud. That's still early days, but he mentioned the triple-digit growth numbers there. Three acquisitions last quarter that are also helping that, the observability suite in particular. So there's just numerous tailwinds.
Got it. And I appreciate the thoughts there. And then my question for you, Doug, is as enterprise starts your journey in sort of moving to a cloud operating model and frankly, building a new security fabric to enable that cloud operating model, we're starting to see some security vendors, whether it's CrowdStrike or Zscaler or Palo Alto, start to get into the monitoring game and a long-standing trend is monitoring guys getting into the security space. As we look at sort of the opportunity within cloud, building a cloud security fabric, who's going to have the strategic high ground? Whether it's the endpoint providers, the networking guys, coming from the policy layer or coming from the data layer like Splunk is? In the eyes of customers, how are they thinking about building out these new security capabilities?
It's a good question. Our view of the space has been consistent for my entire time here, so I guess seven-plus years now, that security is a data problem. The many, many different tools and proprietary elements that are thrown into that landscape to attempt to be a patchwork to prevent and remediate the huge variety of challenges and changes that customers have to deal with doesn't seem to have ever slowed down, doesn't seem to be slowing down now. And the only way that you can really make sense of that patch work is to have an effective, malleable, high-capacity non-structured data layer to be able to take in the constantly shifting data feeds and provide the full suite on monitoring, alerting, detection, remediation, investigation that we've been building our Data-to-Everything platform around and the security solutions around as well.
So I think that firms like Splunk are in a unique position. We're very open across the entire landscape. As you can see through Splunkbase and everything that exists in the market, we interoperate with and play with everybody because we don't have a dog in the hunt on the endpoint game in the network game. There's too much variety within these different organizations. The strength that I think that organizations are continuing to wake up to is the data that you are going to touch and wrangle for your security needs is the identical data sources, in most cases, that you also need to touch and wrangle for your infrastructure management, ITOps needs and increasingly, for your application development and DevOps needs.
And that's where I think the real power of all the investments we've made across the data platform and the solutions on top become even more of a true return on investment outstanding player. And that – we've stuck with that strategy for many, many years. We continue to stick with that strategy. And we think it's the right strategy to help our customers in a very heterogeneous landscape that not only is multi-cloud, but multi on-prem and cloud versions.
Thanks a lot and thank you for the thoughts, Doug.
Thank you. Our next question comes from the line of Keith Bachman from Bank of Montreal. Your line is now open.
Thanks very much, and congratulations on the quarter. Doug, I wanted to start with you, and you used the word scrutiny, which is something that we've had conversations about with investors recently. And I want to break that down into something specific surrounding win rates. And the three buckets are security, ITOps and then observability. Could you talk about as budget dollars get scrutinized, whether that's changed win rates at all? And if you could go through those three buckets, if you will, and characterize it? And then I have a follow-up.
Yes. And the buckets are important because the dynamics are very different between the three buckets. Then I'd add the fourth bucket, which is kind of general data platform layer as well. There are always shifts within those. But the overall win rates that we see in aggregate across all four buckets have remained super consistent. We've been in the mid-80s to upper-80s on a win rate basis overall across the entire landscape. The puts and takes vary based on shifts that are happening in the quarter where we are the new entrant, which is something that we're not used to. We kind of came in and led the security arena. We led the ITOps arena. I think we led the unstructured high-volume data platform arena, and the observability area.
So there's a lot of intensity and scrutiny that I am giving and the sales teams are giving and the marketing teams are giving, the competitive teams are giving to make sure that the recognition that we're starting to gain as the most functionally rich and capable solution, that translates into understanding by the customers, that translates into ad bats and RFP inclusion, and that, that translates into increasing win rates in that arena. So when I really look across the Board, my – I think our number one focus is we really believe that's a strong emerging category, still pretty small, a lot of players, but growing fast as we can see with us and our competitors and one that we really want to ensure that we're successful in.
The other three, I think, is more about continuing to try and stay a step ahead of the competitors. We've got really strong position in those three, whether this gets Elastic or Sumo or certainly, QRadar, last generation SIMs, the cloud service providers, as they continue to try and strengthen their security offerings.
And so going back to my earlier comments, the tailwinds that we're getting or the combinatorial impacts that we're getting in ITOps as we're leveraging some of the DevOps and the observability capability, I think, is helping us, and that should be a big impact this year. And we're really, really focused on making sure that the deliveries we have slated in the security arena hit with the quality and ease of use that we're looking for, and we keep our lead in the security space.
Okay. Yes. It seems like your leading security space is good. The one I was really wondering about was ITOps. But let me move over to Jason in the net retention rate or cloud net retention rate. Anything you want to call out, Jason, on puts and takes as we think about that, how that number rolls out through the year? It's good news to hear that new logos may increase during the year, certainly did in Q4. So hopefully, that keeps up. But Jason, anything you want to tell us or call out on the net retention rate?
Well, I mean not really. I mean, it's been consistent. And obviously, as the numbers get much larger, once you get to approximately getting close to $1 billion in ARR, to hold a high-20s, 120-plus percent net retention is – it's pretty rare. So overall, we're very happy with the numbers that we see.
And at this point, every quarter, there's probably a little bit of nuance between – is the growth coming more from logos or coming from expansion within existing accounts. Overall, pretty much everything is up into the right, right now with cloud. And we'll let you know if something changes. But I think the progress is pretty clear and something we're very proud of.
Okay. Thanks very much. Cheers.
Thank you. Our next question comes from the line of Michael Turits from KeyBanc. Your line is now open.
A couple of questions for Jason. First of all, on RPO, which do you sell on total this quarter? And you did mention, obviously, there's been some duration headwinds. I just want to make sure I get the mechanics right, Jason, that there's a – from my understanding is there's more that will be up for renewal, essentially in next year, and we'll start to get, therefore, an acceleration in both total and current RPO?
You got it. That's right. And basically, the – in the older days, if you got to break out, RPO is really two primary components. So when you sell term, it's either going to be if you're having long-term ramping deals where you have capacity growing over time. The only thing that sits in RPO is the piece that ramps. And so as duration comes down, we have a lot less of that right now. So you're kind of lapping a period where you had more gains to RPO in the past because of ramping deals.
The other aspect of term would be, of course, the maintenance. And so if you have longer durations, you're going to have more RPO coming from the longer maintenance contracts. Then that's offset by the cloud aspect since almost all of cloud sits in RPO and then, of course, is recognized ratably into revenue every quarter. So as – and so while cloud is growing quickly, we're coming off of some pretty huge term RPO gains that were put in place really over the past couple of years when we made the perp-to-term conversion motion. Now as those – a lot of those big initial term deals are coming up for renewal this year, you're going to see the renewal base grow significantly. And as we sign those renewals, you'll see RPO start to replenish and grow pretty significantly, especially in the back half of this year.
And that should impact total and current as well, correct?
It will impact both. The duration impact, of course, is more on – is going to be more on total RPO. Current is going to be more impacted by cloud.
Right. And then, Doug, I hope you don't mind if I ask Jason another question here. Sure, I'll bug you about stuff. And so...
Not at all.
But obviously, I understand it's a volatile time, so we didn't get the fiscal 2022 or the long-term guide. But given what seems, at least factoring out duration, that you should have a little bit more visibility into – in the ACV, are we at the point where we can get some feel for cash flow from ops this year? Or you're minus $200 million this year, does that flip in a meaningful way this year? I would think you'd have a little more of a view there.
Well, the biggest driver to cash flow, first, is that we are now lapping the impact of changing the invoice – invoicing methodology two years ago. That happens in – starting in the Q3. So that's the biggest reason why now we're no longer – a couple of years ago, we went from a period of collecting most of our revenue upfront to now collecting or invoicing annually. And since we're at about a two and a half year average, that means we had kind of a hole in the last two years. So we started lapping that in Q3. So that's the biggest impact.
Let's say, second, then ARR growth is what's going to be the new and expansion of – within accounts and new customers is what's going to lead to incremental ARR. That's going to lead to more inflow. The offset, though, is we're not guiding beyond Q1. And therefore, I can only speak to the ARR piece at this point. What I can say is you will definitely see cash flow revert to positive this year. And then I'd say, we'll update you to the magnitude of the cash flow as we kind of go throughout the year quarterly.
Thanks, Jason, and thanks, Doug, for not being offended on the focus on financials.
Thank you. Our final question comes from the line of Kirk Materne from Evercore ISI. Your line is now open.
Yes. Great. Thanks for sneaking me in. Doug, maybe just to start with you. It seemed like the international business had a pretty nice quarter. Obviously, a good quarter for term licenses. So maybe, I imagine it's a little bit heavier on the international front on that side. But can you just talk about that bump? And it seemed like it outperformed a little bit this quarter and just what you're seeing in that theater? And maybe if any of the trends around cloud are a little bit different internationally than in the U.S. right now?
Yes. Very good call out. Yes, I'm really, really proud of the international teams. In particular, EMEA had a fantastic quarter in Q4. It's been – but what I'm really excited about is it's been a steady build all year long. The leadership team that we have over there, I think, has just done a fantastic job of emphasizing the right things, the right relationships with the reps, transitioning through a really difficult year of a lot of chaos, of stay at home – no, don't stay at home, that EMEA has had to deal with. And I think it's laid the foundation for what I believe will be consistent performance over the coming years. Same thing in select markets in APAC, who also – they were early on with the pandemic and have had a bunch of variety of challenges they've had to deal with.
Cloud does tend to be a little bit behind. It depends on the market. Australia is a lot more like the U.S. Central Europe is a little bit behind as far as cloud. But my other highlight that I saw internationally this year, especially again, in EMEA, was a really, really strong shift and expansion from where they were on the cloud business as well. I think the pandemic certainly creates some headwinds on things like deal scrutiny or big deal scrutiny. But it certainly has emphasized the need for every organization to pivot to cloud and invest much more strongly with cloud. I'd say that, that had an impact on our cloud ARR and revenue, but it's actually been – our growth there has actually been pretty consistent.
But it's certainly, I think, it's probably helping it to stay at such a consistent rate. And I think it's a big opportunity internationally as those countries and those verticals become more comfortable with cloud to see the expansion we've been watching in the U.S. happen in the same way internationally.
Okay. And maybe just last one, just because you brought it up. On the big deal scrutiny point, Doug, I was just kind of curious because if you look across the board right now, tech, IT spending budgets are pretty – doing well, meaning I think they're opening up pretty well. So when you're thinking about big deal scrutiny, is that just simply a case of sort of the amount of debt they want to make from a term perspective or a capacity perspective, meaning they're going through a sort of a technology infrastructure shift and that's sort of holding them back? Or are you still seeing companies that are sort of holding back on budget because of the macro? Because I think you're hearing more companies say, hey, things are opening up.
And I realize you have sort of a different game you have to play in terms of helping them through these – the shift from on-prem to cloud. So could you just clarify that maybe a little bit?
Yes. I think it's a little bit of both. I think that the – while there is momentum right now, especially for cloud spend, it depends on the industry, how confident people feel in their overall revenues and, therefore, their ability to increase their spend on IT. I think IT is increasing as a percentage of revenue in most industries.
But when you look at many of the industries that we serve that have been under a lot of pressure, the oil and gas industry, which we're strong in, the retail industry, the travel and hospitality industry, there's a lot of pressure on spend there given the unfair impact that they've had. And that's balanced by expanding portfolios in the high-tech industry. We look at Zoom or Shopify or Atlassian or other key customers that we've had, they're scrambling to keep up right now, which has been good for us. But it's – we're a big enough size now and play across all industries and all major geos.
And then I do think your second point is important, which is, there's a different level of thoughtfulness and scrutiny on on-prem spend than there is cloud spend given that term is still – the on-prem, which is really term, but on-prem is still a majority of our customer counts and bookings. That has, I think, even a more meaningful impact on any quarter forecasting for us than the pandemic itself. Because as Jason talked about term length and size of term deals, and that is more all over the map on a quarter-by-quarter basis, whereas cloud is pretty strong and consistent.
That's right. Thanks for that and congrats on the quarter.
Thank you. At this time, I would like to turn the call back over to Doug Merritt for closing remarks.
Thank you. Well, thank you all for spending time with us. I know there's other companies reporting today. I just want to conclude by going back to a comment I made during the Q&A, which is we've had three very consistent company priorities for the past three-plus years: get to cloud, continue to double down on our three core buying centers and continue to expand our Data-to-Everything platform.
I'm really proud of the progress we're making across all three. I'm really proud of our willingness to continue to innovate and disrupt ourselves so that we can serve our customers effectively and create the right long-term durable growth for all of you as investors. And I'm enthusiastic about what we see in front of us in FY 2022 and FY 2023. We've been making a lot of investment to make sure that all three initiatives continue to move forward.
And I feel like we're very well positioned over the next 24 and 36 months to continue to see benefit from those investments. Just want to call out a huge thanks again to the Splunk community, our employees, our partners, our customers for their support and focus and resiliency to this year. And we'll be talking to you all again in three months for our next earnings call. So thank you.
Ladies and gentlemen, this concludes today's conference call. Thank you for participating. You may now disconnect.